CISA plans service review, sharper focus on critical infrastructure threats

The Cybersecurity and Infrastructure Security Agency will review its services and concentrate resources on infrastructure whose disruption would cause the greatest harm, under a strategy released Monday that calls for a more targeted approach to defending essential systems.

The CISA 2030 strategy directs the agency to use intelligence about hacking threats and the potential consequences of intrusions to decide where assistance and investment should go. It also emphasizes removing hackers from networks before they can disrupt operations.

“We will deprioritize threat-agnostic, all-hazards approaches and embrace risk-informed, consequence-based analysis,” the document reads.

The agency would focus more closely on infrastructure whose loss would most affect public safety, the economy and national security. The strategy does not identify which services would receive fewer resources or which components would take priority.

CISA will begin reviewing its core services and capabilities within 60 days to determine how they support the strategy’s objectives. That deadline applies to starting the review, not completing it. Within 180 days, the agency will deliver an approach for implementing the strategy and measuring results. A progress update is due within 365 days. 

The plan comes as CISA works to rebuild after workforce reductions in President Donald Trump’s second term have impacted roughly a third of its staff. Acting Director Nick Andersen said in September that about 250 prospective employees had tentative offers and were awaiting clearance, with hiring focused on operational teams and regional personnel. Over the last several weeks, CISA has regularly posted LinkedIn updates highlighting batches of new hires.

The document also argues that CISA’s shifting responsibilities and “unclear” priorities have weakened its focus. The agency does not name specific programs, though the criticism follows the administration’s push to curtail much of the agency’s election security and disinformation work, which Trump officials have characterized as censorship and mission overreach.

The dispute dates to Trump’s firing of then-CISA Director Chris Krebs after he affirmed the results of the 2020 election, contradicting the president’s unfounded claims that it was stolen. Trump officials have since cited censorship allegations to justify shrinking CISA, while former officials have warned that the reductions weaken its broader ability to protect infrastructure from hackers.

Andersen calls for an “aggressive, anticipatory stance” to remove adversaries from defense-critical infrastructure before they can use that access against the United States. The strategy describes defensive work with partners but does not establish new legal authorities.

CISA plans to coordinate more closely with intelligence agencies and infrastructure operators, improve threat alerts and help the White House develop a National Risk Register to identify and quantify infrastructure risks.

The plan also calls for protecting operational technology — the equipment and software that control physical processes at water plants, factories and other facilities. Other priorities include software-security guidance and addressing risks from artificial intelligence — described in the document under Trump-era terms as “super intelligence” — and quantum computing. CISA also plans to expand emergency communications using newer cellular networks and commercial satellites.

“We must ensure that when adversaries gain a foothold, we are prepared to detect them quickly, evict them decisively, and keep critical operations running without interruption,” Andersen writes in the strategy document.